Re: [PATCH v3] ieee1275 : Add a check for invalid partition number

On 1/12/26 08:29, Avnish Chouhan wrote:
> Adding a check for invalid partition number. grub_strtoul() can fail
> in several scenarios like invalid input, overflow, etc will result in
> an invalid partition number which could lead to an undefined behavior.
> 
> Signed-off-by: Avnish Chouhan <[email protected]>
> ---
>   grub-core/kern/ieee1275/openfw.c | 17 +++++++++++++++--
>   1 file changed, 15 insertions(+), 2 deletions(-)
> 
> diff --git a/grub-core/kern/ieee1275/openfw.c b/grub-core/kern/ieee1275/openfw.c
> index 3b492dd..f8ae515 100644
> --- a/grub-core/kern/ieee1275/openfw.c
> +++ b/grub-core/kern/ieee1275/openfw.c
> @@ -512,7 +512,20 @@ grub_ieee1275_encode_devname (const char *path)
>       }
>     if (partition && partition[0])
>       {
> -      unsigned int partno = grub_strtoul (partition, 0, 0);
> +      char *endptr;
> +
> +      unsigned long partno = grub_strtoul (partition, &endptr, 0);

I recommend setting the base instead of letting it be 0. An input string 
of "[" would be accepted as the number 43.

> +      grub_errno = GRUB_ERR_NONE;

I believe grub_errno should be set before the call to strtoul() instead 
of after it. Setting grub_errno before would allow you to use it as part 
of your error checking below.

Regards,
Nicholas Vinson

> +
> +      if (*endptr != '\0' || partno > 65535 ||
> +          (partno == 0 && ! grub_ieee1275_test_flag (GRUB_IEEE1275_FLAG_0_BASED_PARTITIONS)))
> +        {
> +          grub_free (partition);
> +          grub_free (device);
> +          grub_free (encoding);
> +          grub_error (GRUB_ERR_BAD_ARGUMENT, N_("invalid partition number"));
> +          return NULL;
> +        }
>   
>         *optr++ = ',';
>   
> @@ -520,7 +533,7 @@ grub_ieee1275_encode_devname (const char *path)
>   	/* GRUB partition 1 is OF partition 0.  */
>   	partno++;
>   
> -      grub_snprintf (optr, sizeof ("XXXXXXXXXXXX"), "%d", partno);
> +      grub_snprintf (optr, sizeof ("XXXXXXXXXXXX"), "%lu", partno);
>       }
>     else
>       *optr = '\0';


_______________________________________________
Grub-devel mailing list
[email protected]
https://lists.gnu.org/mailman/listinfo/grub-devel